Five hot legal issues: affecting information technology.

• Author: Orich, Christine
• Position: Advice Info Tech

SEVERAL RECENT LEGAL developments could impact or already have significantly impacted the world of information technology. Those in charge of IT need to be aware of these developments so that they can assess potential risks and capitalize on new opportunities.

THE SARBANES-OXLEY ACT

IT projects are likely to become more visible at public companies and at the private companies who provide IT services to them, as a result of the SarbanesOxley Act of 2002.

Section 201 prohibits firms that audit a public company's books from also providing IT-related services to the company. Section 302 requires company executives to sign a statement verifying the accuracy and completeness of financial reports, and Section 404 will require company executives and outside auditors to attest to the effectiveness of internal controls for financial reporting. To comply with these provisions, many companies will need to review the procedures governing use and validation of their financial and accounting software.

The act also requires businesses to disclose "all material off-balance-sheet transactions" that may affect capital expenditures. Consequently, those charged with managing IT projects will likely be asked for more detailed information to substantiate expenses. Outside consultants engaged in such projects may be similarly pressured.

THE USA PATRIOT ACT

Companies may be asked to share their data with the FBI pursuant to the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001.

Section 215 of the Patriot Act amends an obscure 1978 law to allow broader access by the government to private data. Section 215 states that federal agents may apply for "an order requiring the production of any tangible things, for an investigation to protect against international terrorism or clandestine intelligence activities." "Tangible things" includes business records.

In view of Section 215, privacy policies should be reviewed to make sure information requests under the Patriot Act are adequately addressed. Companies should take steps to...